AI law is moving on many fronts at once: dedicated AI laws, data protection, consumer protection, employment, sector rules, court rules and bar guidance. The General Counsel needs a radar, not a reading list.
The landscape in brief
- EU AI Act: in force since 1 August 2024, applying in stages. Prohibited practices applied from 2 February 2025 and obligations for general-purpose AI models from 2 August 2025. In May 2026 EU legislators reached a political agreement (the "Digital Omnibus") to postpone high-risk obligations to 2 December 2027 for stand-alone high-risk systems and 2 August 2028 for AI in regulated products. Check the current status before relying on dates.
- U.S. states: several states have passed AI laws, and they change. Colorado's 2024 AI Act was postponed in 2025, its enforcement was stayed by a federal court in April 2026, and in May 2026 the governor signed SB 26-189, which repeals and re-enacts it with a narrower approach from 1 January 2027.
- Existing law applied to AI: regulators enforce consumer protection, securities, employment and anti-discrimination law against AI uses (for example, the SEC's AI-washing cases and the EEOC's first AI hiring settlement in 2023).
- Courts and bars: standing orders on AI use in filings and ethics opinions on lawyers' AI use.
Build the radar
- Inventory first: you can't know what applies until you know which AI the company uses and where.
- Map laws to uses: tag each AI system with the jurisdictions and categories that apply (for example, high-risk use, automated decisions about people).
- Owner and rhythm: one named owner, a monthly review and a quarterly note to the executive team.
- Translate into actions: each change becomes a task with a date and owner, not just an alert.